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Alexandria, VA 223 13-1450 " 

Responsive to the Interview Summary mailed on November 19, 2004, the Applicant 
submits the following remarks for the Examiner's consideration. The Applicant notes thai the 
response filed on November 1 1. 2004 contains an interview summary as required by 37 C^F.R. § 
1.133(b). As a courtesy, the Applicant has provided another copy of that smnmary listed below. 
Additionally, the Applicant submits supplemental remarks in response to some points raised by 
the Examiner* Interview Summary. 

Applicant Summary of Telephonic Interview of November 2, 2004 

The Applicant and the undersigned thank the Examiner for his time and consideration 
given during the telephonic interview of November 2, 2004. During this telephonic interview, a 
proposed amendment to the claims was discussed The Applicant provided the proposed 

I hereby certify that Ais correspondence is being facsimile transmitted to: Mai! Stop Amendment, 
Commissioner for Patents, , P.O. Box 1450, Alexandria, VA 22313-1450, Attn: Examiner Kiss, GAU 
2122, Facsimile No. (703) 872-9306. on December 15, 2004. 
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amendment to the claims in advance of the interview and in connection with an Applicant 
Initiated Interview Request Fonn submitted by the Applicant on October 25, 2004. 

Examiner Kiss provided his thoughts on the proposed changes to the claims. The 
Examiner stated that he did not believe that the 1997 article entitled 'OJnderstanding Heuristics: 
Symantec's Bloodhound Technology^' (hereinafter, the 'XFHSBT reference'") provides any 
teaching of generating a behavior pattern for the target program by tracking liinctions performed 
and not performed by the target program with flags in a behavior pattern field and by tracking a 
sequence in which the functions are called by the target program with the behavior pattern field, 
as was provided in proposed amended independent Claim 1 1 . The undersigned agreed with the 
Examiner that the UHSBT reference does not provide any discussion of how it tracks behaviors 
of target programs. 

In the proposed amendment submitted on October 25, 2004 to the Examiner, only 
independent Claims 1 U 20, and 26 included the language describing how a behavior pattern is 
generated with a behavior pattern field. The Examiner and undersigned agreed to amend each of 
the independent claims to include the language describing the behavior pattern as this feature 
was not taught by the UHSBT reference. The Examiner stated that while the UHSBT reference 
does not appear to teach the generation of ajiehavjor pattern as cjajmed, Jhe ExaminCT ij^^ 
that he would need to conduct an update search before any final decision is made with respect to 
the claims. 

The Applicant and the undersigned request the Examiner to review this interview 
summary and to approve it by writing ^'Interview Record OK" along with his initials and the date 
next to this summary in the margin as discussed in MPEP § 713.04, p. 700-202. 

Response to Examiner's Request for Clarificatiqn 
as Mentioned in Examiner's Interview Sammarv 

The Examiner requested Applicant's representative to check the application for support 
of the amendments made to the claims. Specifically, the Examiner invited clarification as to 
whether the new limitations added to the claims suggest that sequence information is stored 

within the behavior pattern field. 

The Applicant notes that page 23, lines 1-10 describe a behavior pattern field (Tstruct) 
that sets flags as the functions represented by those flags are virtualized. The sequence in which 
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these functions are called is recorded in a sequencer. In light of these teachings, il is believed 
that the behavior pattern field tracks functions performed and not perfonned by the target 
program as well as the sequence of the functions performed. In other words, the behavior pattern 
field provides sequence information to the sequencer and therefore, the behavior pattern 
performs the function of tracking the sequence in which functions are called by the target 
prograni. 

If the Examiner has any questions regarding these remarks, he is invited to contact the 
undersigned by telephone. 

CONCLUSION 

The foregoing is submitted as a full and complete response Examiner Interview Summary 
mailed on November 19, 2004. The Applicant and the undersigned thank Examiner Kiss for 
consideration of these remarks and interview summary. The Applicant rcapectfiiUy submits that 
the present application is in condition for allowance. Such action is hereby courteously sohcited. 

If the Examiner believes that there are any issues that can be resolved by a telephone 
conference, or that there are any formalities that can be corrected by an Examiner's amendment, 
please contact the undersigned in the Atl anta Metro poUtan^r^ (404)J72j884. — — 

Respectfully submitted, 

SteveriJP. Wigmore 
Reg^o. 40,447 



King & Spalding LLP 
191 Peachtree Street, N.E. 
Atlanta, Georgia 30303-1763 
telephone: (404) 572.4600 
K&S File No. 05456-105041 
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